io/channel-websock: send an HTTP 400 when the greeting has no space

qio_channel_websock_extract_headers() returns 0 without queueing a
response when the request line contains no space, unlike every sibling
check which jumps to bad_request. encoutput stays empty, yet
qio_channel_websock_handshake_read() still reports success and the
caller arms a G_IO_OUT watch to flush nothing.

Flushing that empty buffer is where QEMU crashes. Any client can
trigger it before authentication on a VNC websocket port:

  printf 'stats\r\nx\r\n\r\n' | nc $host $port

Fixes: 07e95cd529af ("io: fully parse & validate HTTP headers for websocket protocol handshake")
Fixes: f69a8bde2935 ("io: send proper HTTP response for websocket errors")
Fixes: CVE-2026-84788
Cc: qemu-stable@nongnu.org
Cc: Daniel P. Berrangé <berrange@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/io/channel-websock.c b/io/channel-websock.c
index 1929abf56a..66c91ed2a2 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -230,7 +230,7 @@ qio_channel_websock_extract_headers(QIOChannelWebsock *ioc,
     tmp = strchr(buffer, ' ');
     if (!tmp) {
         error_setg(errp, "Missing HTTP path delimiter");
-        return 0;
+        goto bad_request;
     }
     *tmp = '\0';